Legal

Privacy Notice

Last updated: 2 October 2026

This notice tells you which personal data arise when you visit prewen.ch, what we do with them and what we do not. It follows the Swiss Federal Act on Data Protection (FADP).

We have kept it short because the website collects little. Where we do not know something precisely, we say so here — rather than using wording that feigns precision.

1. Who is responsible for the processing

Prewen AG, Schifflände 26, 8001 Zurich, Switzerland
info@prewen.ch · +41 43 818 29 29

We have not appointed a data protection advisor under Art. 10 FADP; doing so is voluntary. The address above is the point of contact.

2. If you only look at this website

The website is operated and delivered by Framer B.V. (Amsterdam, Netherlands). When you open a page, your browser transmits technically necessary information to its servers, including your IP address, the page requested, the date and time, and details about your browser and operating system.

We have no access to these server logs ourselves. We therefore cannot tell you that they contain nothing about you, nor can we give you access to them — we tell you this instead of making a claim we cannot substantiate.

Images and fonts on this website are delivered via framerusercontent.com, a service of the same provider.

3. Visitor statistics

We use the visitor statistics built into Framer to see which pages are opened. According to the provider, they work as follows:

  • No cookies are set and no persistent identifiers are created.

  • Your IP address and browser identifier are not stored; instead, they are converted into a checksum using a secret value that changes daily. This secret is deleted and regenerated every day.

  • This makes it possible to count how many different people visited the site on a given day, without any recognition beyond that day.

What we receive are totals, not individual profiles: page views, referrers, country, device type. We cannot attribute a visit to any particular person.

4. Cookies

This website sets no cookies — neither for advertising nor for analytics. It stores nothing else in your browser either. That is why you see no consent dialogue here: there is nothing you would need to consent to.

5. Contact form

On our contact page you can write to us. We collect:

Name: required

Email: required

Message: required

Company: optional

Phone: optional

Purpose: we handle your enquiry and reply to you. The information is transmitted through Framer's form system and stored there; it also reaches our mailbox at Microsoft (Microsoft Ireland Operations Limited, Ireland).

What we do not do with it: we do not add you to a newsletter or a marketing list because of an enquiry, and we do not pass your details on for third-party advertising.

Retention:

in Framer's form system: 30 days after receipt. There, the enquiry is only a transit copy

in our mailbox, if no business relationship arises: 24 months

in our mailbox, if a business relationship arises: 10 years — we are required to retain business correspondence (Art. 958f Swiss Code of Obligations)

6. The live demo

This section is longer than the others because more happens here than when you read a page — and because you should know exactly what.

On our live demo page you can try out how format-preserving encryption works. The demonstration does not run in your browser alone: your selection is sent to our service demo-api.prewen.ch and from there to a demonstration environment that we operate ourselves.

You cannot enter your own data there. The demonstration works exclusively with predefined, fictitious sample values. Only which sample you selected is transmitted — not any content you typed. The interface rejects any other input.

What arises in the process:

Your IP address and browser identifier: in the protection and logging system of our service. Access runs through Cloudflare with attack protection and rate limiting — without this protective layer, the service would be open to abuse

Your selection (scenario, example, role): as an identifier of the sample, with no personal reference

Retention of these logs: 30 days, then deleted

What does not happen there: no language model is involved. There is no error or usage tracking. Nothing is stored in your browser — no local storage, no database.

7. If you book an appointment

On our contact page you will find a “Book an appointment” button. It is a link: it takes you to cal.com/prewen, a service of Cal.com, Inc. (San Francisco, USA). Nothing is transmitted there before you click — the page contains no embedded booking window.

If you book an appointment there, we process your details — typically your name, e-mail address, the time slot you chose and anything you add voluntarily. Cal.com processes these details on our behalf and stores them in the United States; Cal.com's sub-processors, also in the USA, are involved as well. For this transfer we rely on standard contractual clauses (Art. 16 para. 2 lit. d FADP).

The appointment also appears in our calendar at Microsoft (Ireland).

Your details are then held in two places, with different retention periods — we name both:

at Cal.com: up to 12 months after the meeting, then deleted

in our calendar (Microsoft, Ireland): no fixed period. The entry remains there as part of our contact history: we want to be able to trace whom we spoke to, when and about what. We keep it for as long as this purpose lasts (Art. 6 para. 4 FADP)

We say this so clearly because the second line matters more in practice: the fact that we delete the booking at Cal.com does not mean it disappears at our end. If you would like the calendar entry deleted as well, a message to info@prewen.ch is enough — we will comply unless we have to keep it as a record of a business relationship.

If you would rather not book through this service, write to us at info@prewen.ch or give us a call. A meeting can just as well be arranged by e-mail.

8. Links to other websites

We link to LinkedIn, prewen.ai, praevana.ch and a map service. These links open only when you click them — they are not embedded content. Before you click, none of these providers learns of your visit. After that, their own terms apply.

This website contains no embedded videos, maps, social media components, tracking pixels or chat windows.

9. Fonts

The website uses the typefaces Satoshi and JetBrains Mono. They are served from our delivery network; your browser contacts no further provider for them.

10. Disclosure abroad

Framer B.V.: Netherlands · operation and delivery of the website, form data, visitor statistics

Framer's sub-processors (Amazon Web Services, Google): USA · data centres and delivery network

Cloudflare: USA / worldwide · domain name resolution; for the live demo also attack protection

Cal.com, Inc.: USA · meeting booking, only if you click the button and book there

Microsoft Ireland Operations Limited: Ireland · e-mail mailbox and calendar

In the assessment of the Swiss Federal Council, the Netherlands and Ireland provide adequate data protection; these transfers require no additional safeguards (Art. 16 para. 1 FADP).

For the USA, we rely on standard contractual clauses as provided for in Art. 16 para. 2 lit. d FADP and recognised by the Federal Data Protection and Information Commissioner (FDPIC). We tell you openly what this means: authorities in the United States can, under certain conditions, demand access to data, and such clauses cannot entirely prevent this.

A data processing agreement is in place with every provider that processes data on our behalf (Art. 9 FADP): with Framer B.V., Cal.com, Inc., Cloudflare and Microsoft. Framer's sub-processors are covered by Framer's own chain of agreements.

11. How long we keep data

We keep personal data for as long as the purpose requires and destroy them afterwards (Art. 6 para. 4 FADP). The periods are stated for each data set in the sections above.

Two data sets have no period of their own, and here too we tell you why:

  • The server logs of our provider (section 2) are not in our hands; we cannot determine anything about them.

  • The visitor statistics (section 3) contain nothing that can be related to you — a deletion period would have nothing to apply to.

12. Your rights

You may ask us for:

  • Access: whether we process data about you, and which (Art. 25 FADP). Access is free of charge for you.

  • Correction of inaccurate data (Art. 32 FADP).

  • Deletion or restriction of processing, unless we are required to retain the data.

  • A copy of your data in a common format (Art. 28 FADP), where the conditions are met.

A message to the address in section 1 is enough; you do not need to give reasons. So that we do not release data to the wrong person, we have to verify your identity — we will contact you about this.

You may also contact the Federal Data Protection and Information Commissioner (FDPIC) (Art. 49 FADP).

13. Data security

The website is transmitted exclusively over an encrypted connection (HTTPS). Access to the live demo is additionally protected by attack protection and rate limiting.

14. If something changes

If anything on this website changes that affects your data, we will amend this notice and update the date above. The version published here is the one that applies.